StreamLive Pro

Webhooks for developers: events, signature and delivery

StreamLive Pro webhooks for developers: add an https address in Settings, receive stream.started and other events, and verify the HMAC-SHA256 signature in Node or Python.

Updated November 5, 2026 · 5 min read

A webhook lets StreamLive Pro tell your own server the moment something happens in your account: a broadcast started, a broadcast ended, a payment went through. You add an https address in Settings, in the "API & Webhooks" section, tick the events you want, and from then on every event is sent to that address as a signed POST request with a small JSON body. Webhooks are part of the Studio plan.

This page is the reference: how to add a webhook, what each request contains, how to check the signature, and the exact delivery rules. For the general idea, see What is a webhook? A web address that receives messages. For calling our API with a key, see API keys for developers: create, use and revoke.

Before you start

• The Studio plan. On other plans, and during the trial, the section shows "Available on the Studio plan" and the server refuses to add a webhook. If the account later leaves Studio, nothing is sent; the webhooks stay listed and start again when the account is back on Studio. See /pricing?lang=en.
• A public https address. The address must start with https:// and must point to a server on the internet. Local and private addresses (localhost, 10.x, 192.168.x and the like) are refused, also if a name resolves to one later.
• A server that answers fast. Your endpoint should reply with a 2xx status within 10 seconds. Do slow work after you reply.

Steps

1. Open the section. Go to Settings and choose "API & Webhooks" in the side menu. The second card is Webhooks.
2. Type the address. In URL (https only), paste your endpoint, for example https://example.com/hooks/streamlive.
3. Tick the events. stream.started, stream.ended and payment.succeeded are ticked by default. Untick what you do not need and tick the others you want.
4. Click "Add webhook". The webhook appears in the list under the form.
5. Copy the signing secret now. A box titled "Webhook signing secret" shows the secret once, with a Copy button. Store it in your server's settings. It is not shown again.
6. Trigger a real event. There is no test button. Start a short private broadcast and end it: you should receive stream.started and then stream.ended. The list shows "last delivered" with the date of the last success.

To remove a webhook, click Delete next to it and confirm. You can have up to 10 webhooks per account.

The events

The fields can differ between payment providers, and new fields may be added. Read the fields you need and ignore the rest.

What a request looks like

Every delivery is a POST with these headers:

The body is JSON with three fields:

{"event":"stream.started","timestamp":"2026-11-05T18:00:00.000Z","data":{"stream_id":"...","title":"Weekly class"}}

timestamp is the time the message was made, in UTC.

Checking the signature

Compute HMAC-SHA256 over the raw bytes of the body, exactly as they arrived, using the secret as the key (the secret text as it was shown to you), and compare the hex result with the X-StreamLive-Signature header. Do not parse and re-encode the JSON first: a single changed space breaks the match. Use a constant-time comparison.

Node.js (Express):

const express = require('express');
const crypto = require('crypto');
const app = express();
const SECRET = process.env.STREAMLIVE_WEBHOOK_SECRET;

app.post('/hooks/streamlive', express.raw({ type: 'application/json' }), (req, res) => {
  const got = Buffer.from(req.get('X-StreamLive-Signature') || '', 'utf8');
  const want = Buffer.from(crypto.createHmac('sha256', SECRET).update(req.body).digest('hex'), 'utf8');
  if (got.length === want.length && crypto.timingSafeEqual(got, want)) {
    res.sendStatus(200);                          // answer first
    const msg = JSON.parse(req.body.toString('utf8'));
    console.log(msg.event, msg.data);             // then do the work
  } else {
    res.sendStatus(401);
  }
});

app.listen(3000);

Python (Flask):

import hmac, hashlib, json, os
from flask import Flask, request

app = Flask(__name__)
SECRET = os.environ["STREAMLIVE_WEBHOOK_SECRET"].encode()

@app.post("/hooks/streamlive")
def streamlive():
    raw = request.get_data()
    want = hmac.new(SECRET, raw, hashlib.sha256).hexdigest()
    got = request.headers.get("X-StreamLive-Signature", "")
    if hmac.compare_digest(got, want):
        msg = json.loads(raw)
        print(msg["event"], msg["data"])
        return "", 200
    return "", 401

Delivery rules

• One try, 10 seconds. Each event is sent once. If your server does not answer within 10 seconds, or answers with anything other than 2xx, that delivery counts as failed. There is no retry.
• Redirects are not followed. A 3xx answer is a failed delivery. Give the final address.
• Switched off after 20 failures in a row. Each success sets the count back to zero. After 20 failed deliveries in a row the webhook is disabled, and the list shows "disabled (too many failures)". There is no switch to turn it back on: delete it and add it again (you get a new secret).
• Order and repeats. Events are sent as they happen, not queued. Use stream_id with the event name to ignore a message you already handled, and if you must not miss anything, also check the state now and then through the API (StreamLive Pro REST API reference: endpoints and fields).
• Old messages. timestamp is inside the signed body, so you can safely reject messages older than a few minutes.

What can go wrong

Frequently asked questions

Which plan includes webhooks?

Studio. On other plans and in the trial the section explains that webhooks come with Studio, and the server refuses to add one.

How do I know a request really came from StreamLive Pro?

Compute HMAC-SHA256 of the raw body with your signing secret and compare it with the X-StreamLive-Signature header. If they differ, reject the request.

Does StreamLive Pro retry a failed webhook?

No. Each event is sent once with a 10 second timeout. After 20 failures in a row the webhook is switched off.

I lost the signing secret. Can I see it again?

No. It is shown once. Delete the webhook and add it again to get a new secret.

Can I get a webhook when a live starts on YouTube?

You get stream.started when your broadcast goes live in StreamLive Pro, whatever channels it goes to. The event is about the broadcast, not one network.

Keep reading